SAST False Positives
Why SAST tools report findings that are not genuine vulnerabilities, and how to triage, validate, and reduce false-positive findings without missing genuine vulnerabilities.
Primary question: What are SAST false positives and how should security teams handle them?
Direct answer
SAST false positives are reported findings that do not represent genuine vulnerabilities, caused by limitations in static analysis context, overly broad rules, or assumptions about code patterns that do not hold in the specific application
SAST false positives occur when a static analysis tool reports a finding that does not represent a genuine vulnerability. This happens because static analysis lacks runtime context, cannot always determine whether required conditions for exploitability are present, or uses rules that match code patterns that are safe in the specific application's context.
Handling false positives requires structured triage — reviewing each finding for validity, data-flow completeness, and exploitability context. Reducing false positives at the source involves rule tuning, configuration adjustments, and framework-specific rule sets, while reducing the burden of triage involves automated evaluation and contextual analysis.
Definitions
False positive (SAST)
A finding reported by a SAST tool that does not represent a genuine vulnerability in the application under the defined validation criteria. The reported code pattern exists, but one or more required conditions for exploitability are not met, or the data flow cannot be established.
Triage
The process of reviewing SAST findings to determine which are genuine vulnerabilities requiring remediation and which are false positives that can be closed with documented rationale.
Precision (SAST)
The proportion of SAST-reported findings that are genuine vulnerabilities. High precision means most reported findings are valid; low precision means many reported findings are false positives. Precision is measured against a defined evaluation scope.
The engineering problem
High false-positive rates consume security team time, create alert fatigue, and risk causing genuine vulnerabilities to be dismissed through desensitization.
Rule tuning to reduce false positives may also reduce detection coverage, potentially increasing false negatives. Organizations must balance precision and recall.
Developers may dismiss SAST findings as unreliable when false-positive rates are high, reducing the overall effectiveness of the SAST program.
A finding reported by only one SAST tool is not automatically a false positive. It may simply be a vulnerability that only one tool's detection approach can identify.
Security controls
Each control inspects a different artifact and produces evidence for an engineering decision.
Structured triage
SAST finding triage- Artifact
- SAST findings reviewed for validity, data-flow completeness, and exploitability context.
- Risk
- Dismissing genuine vulnerabilities as false positives; wasting effort validating false positives.
- Output
- A triaged finding set with documented disposition for each finding — genuine vulnerability, false positive, or requires additional investigation.
Evidence:
Rule tuning
SAST rule configuration- Artifact
- SAST rule set adjusted to reduce false positives while maintaining acceptable detection coverage.
- Risk
- Reducing false positives at the cost of increased false negatives.
- Output
- A rule configuration that balances precision and recall for the specific codebase and technology stack.
Evidence:
Automated evaluation
AI-assisted triage- Artifact
- Automated contextual evaluation of SAST findings to assess validity and provide reasoning.
- Risk
- Overreliance on automated evaluation without human validation for high-severity or ambiguous findings.
- Output
- Pre-triaged findings with validity assessments and reasoning, reducing manual triage effort.
Evidence:
Verification workflow
- SAST produces findings for the codebase.
- Findings are triaged — reviewed for validity, data-flow completeness, and exploitability context.
- Automated evaluation (if available) assesses each finding's validity and provides reasoning to support triage decisions.
- Genuine vulnerabilities are assigned for remediation; false positives are documented and closed with rationale; ambiguous findings are escalated for manual review.
- Rule tuning is applied based on triage outcomes to reduce recurring false positives while maintaining detection coverage.
- The cycle repeats for each new build or scan.
DerScanner · Enterprise
Relationship to DerScanner
DerScanner provides SAST analysis with DerTriage, an automated triage capability that evaluates findings in context and can assign disposition statuses when configured.
DerScanner performs static analysis and provides DerTriage, which evaluates reported findings in context and can automatically assign disposition statuses when configured, reducing manual triage effort. [derscanner-sast]
Limits of verification
- Rule tuning to reduce false positives may also reduce detection coverage. There is no configuration that eliminates all false positives without risking missed vulnerabilities.
- Automated triage tools may miss nuanced context. Human validation remains necessary for high-severity findings, ambiguous cases, and policy exceptions.
- False-positive rates vary by technology stack, code quality, and rule configuration. A rate acceptable in one codebase may be unacceptable in another.
- A finding unique to one SAST tool is not automatically a false positive — it may reflect genuine detection differences between tools.
Related knowledge
SAST False Negatives
The complementary problem of missed vulnerabilities
Relationship: related-toSAST Accuracy
How accuracy encompasses both false positives and false negatives
Relationship: related-toReducing SAST False Positives
Practical guidance on reducing false-positive generation and disposition burden
Relationship: related-toAI Vulnerability Triage
How AI-assisted triage evaluates SAST findings for validity
Relationship: related-toValidate SAST Findings
How to validate individual SAST findings for accuracy and exploitability
Relationship: related-toCanonical terms used: SAST false positive; False positive triage; SAST precision; Over-reporting.
Evidence and references
- DerScanner SAST documentationDerScanner performs static analysis of supported source and binary formats, provides configuration-file analysis, and reports and compares analysis results. DerTriage and DerCodeFix are available within static analysis.
derscanner-sast
Finding triage